ProjectManagement

Unit11

Unit11

ProjectRiskManagement

Structure
11.1 11.2 Introduction PlanningforProjectSurprisesCopingwithRisk Whentoperformriskmanagement? Riskidentification

11.2.1 11.2.2 11.3 11.4 11.5 11.6 11.7 11.8

RiskAnalysis RiskManagementplanning ReviewRisks RiskManagementProcess OverviewofRiskmanagement Summary TQs AnswertoSAQsandTQs

11.1 Introduction
Inanyproject,itisdifficulttoassessthequantumofrisksinvolved.Thereforecarefulplanningwill resultinminimizingtheriskinaproject.Theformulationofaprojectisbasedontheestimatesof the past data available with the project management team. The data may have been from the recorded information about past projects executed successfully or from the experience of the projectmanagementteammembers.Therewillbelotsofuncertaintiesandsurprisesinaproject duringitsexecution.Itisnecessarytoanalyzeandestimatetheprojectinallrespectsinorderto enablethemanagertakeproperdecisionontheproject.Theriskanalysisofaprojectisusedfor thefinancialappraisaloftheproject.

SikkimManipalUniversity

160

ProjectManagement

Unit11

LearningObjective:

1. Thesituationofriskandalsoidentifytheproblemofrisk. 2. Analyzetheriskandthestepsnecessarytomanagetherisks. 3. Theprocessesneededtoreview arisksituationandtheriskanditscauses 4. Howtomitigaterisk.

11.2

PlanningforProjectSurprisescopingwithRisk

Whetherornotyouthinkyourproject(softwareproductorprocessimprovementeffort)isplagued with problems, you might need effective risk management to keep you out of trouble. Risk management is similar to performing preventive health care and buying insurance for your project.Itinvolvesidentifyingpotentialproblems(risks),analyzingthoserisks,planningtomange them,andreviewingthem.

Many development groups run project without any consideration for the problems that might occur. Risk managementisinsuranceforprojects, and canhelp reduce your costsandefforts whentroublestrikes.Itcanalsohelpyoupreventproblems.Whenriskmanagementtechniques areused,youcanpreventproblemsandanticipateotherstomaketheprojectrunsmoothly.

Therearedifferenttypesofriskinvolvedinaproject.Themaintypesare a) Projectrisksitistheriskarisingoutofachangeinthescopeoftheproject,changesinthe work quantities, changes in the resource requirements, estimation error or unexpected developmentsinaproject. b) Market risks it is the risk arising out of a change in any of the following marketing parameter price change, changes in market regulations, economic changes, competition, competitorsproductchanges,etc. c) Industryriskitistheriskarisingoutofachangeinscientificinstrumentsusedinbusiness activity,changesincompaniespoliciesbecauseofchangesintheindustry.

SikkimManipalUniversity

161

ProjectManagement

Unit11

d) Social and political risk it arises out of changes in labour situation, labour laws, environmentlaw,etc.

11.2.1 WhentoPerformRiskManagement?
The risk process, described below, should be performed at the beginning of a project, at the beginningofmajorphasesinaproject(e.g.,requirements,design,coding,anddeployment)and when there are significant changes (e.g., feature changes, target platform changes and technologychanges).

Attheendofthisunit,wehaveprovidedyouwithacopyofourriskprocess.Itissimple,effective, andtakes90to120minutesforprojectsthatare1260personmonths.Projectssmallerthan12 personmonthstake4060minutes.Youcancontrolthelengthofthesessionbycontrollingthe scopeyoupick.Mostsessionsusuallytakelessthantwohours.

Therearefourstepstomanagearisk:

1. 2. 3. 4.

Riskidentification, Riskanalysis, Riskmanagementplanning,and Riskreview.

11.2.2 RiskIdentification
To identify risks, we must first define risk. Risks are potential problems, ones that are not guaranteedtooccur.Whenpeoplebeginperformingriskidentificationtheyoftenstartbylisting known problems. Known problems are not risks. During risk identification, you might notice someknownproblems.Ifso,justmovethemtoaproblemlistandconcentrateonfuturepotential problems.

Riskidentificationcanbedoneusingabrainstormingsession.Thebrainstormtypicallytakes15 30minutes.Besuretoinviteanyone whocanhelpyouthinkofrisks.Invitetheprojectteam, customer, people who have been on similar projects, and experts in the subject area of the project.Limitthegroupsizetoninepeople.Inthebrainstormingsession,peoplecalloutpotential problemsthattheythinkcouldhurttheproject.Newideasaregeneratedbasedontheitemson

SikkimManipalUniversity

162

ProjectManagement

Unit11

the brainstorm list. A project manager can also use the process to refer to a database of risk obtainedfrompast.

The information obtained from such databases can help the project manager to evaluate and assessthenatureoftheriskanditsimpactontheproject.Alsotoagreatextentthejudgmentof the project manager based upon his past experience comes very handy in dealing with risks. Another important method is to generate alternative solution or methodology to deal with risk. Generatesolutionbymeansofgroupreviewmeetings orabrainstormsession. Duringthebrainstorm,considerthefollowingitems:

Selectionofweakareas inaproject, suchasunknowntechnologybeingusedortobeused. Things, that are critical or extremely important to the effort, such as the timely delivery of a vendorsdatabasesoftware,creationoftranslators,orauserinterfacethatmeetsthecustomers needs.

Thingsthathave causedproblemsinthe past, suchasloss of key staff, misseddeadlines,or errorpronesoftware.

Example of risks are: We may not have the requirements right, The technologyis untested, Keypeoplemightleave,TheserverwontrestartinsituationX,andPeoplemightresistthe change.Anypotentialproblem,orcriticalprojectfeature,isagoodcandidatefortherisklist.

Onceyouhavecreatedalist, work withthegrouptoclarityeachitem.Duplicateitemscanbe removed.

SelfAssessmentQuestions1:TrueorFalse
1. Risk management is insurance for projects, and can help reduce your costs and efforts whentroublestrikes. 2. 3. Industryriskarisesoutofchangesinlaboursituation,labourlaws,environmentlaw,etc. Risksarepotentialproblems,onesthatareguaranteedtooccur.

SikkimManipalUniversity

163

ProjectManagement

Unit11

11.3 RiskAnalysis
The first step in risk analysis is to make each risk item more specific. Risks such as, Lack of Managementbuyin,andpeoplemightleave,arealittleambiguous.Inthesecasesthegroup mightdecidetosplittheriskintosmallerspecificrisks,suchas,managerJanedecidesthatthe projectisnotbeneficial,Databaseexpertmightleave,andWebmastermightgetpulledoffthe project.

Thenextstepistosetprioritiesanddeterminewheretofocusriskmitigationefforts.Someofthe identified risks are unlikely to occur, and others might not be serious enough to worry about. During the analysis, discuss with the team members, each risk item to understand how devastatingitwouldbeifitdidoccur,andhowlikelyitistooccur.Forexample,ifyouhadarisk ofakeypersonleaving,youmightdecidethatitwouldhavealargeimpactontheproject,butthat itisnotverylikely.

Intheprocessbelow,wehavethegroupagreeonhowlikelyitthinkseachriskitemistooccur, usingasimplescalefrom1to10(where1isveryunlikelyand10isverylikely).Thegroupthen rates how serious the impact would be if the risk did occur, using a simple scale from1 to 10 (where 1islittleimpactand 10isvery large). To use this numbering scheme,first pickout the itemsthatrate1and10,respectively.Thenratetheotheritemsrelativetotheseboundaries.To determine the priority of each risk item, calculate the product of the two values, likelihood and impact.Thispriorityschemehelpspushthebigriskstothetopofthelist,andthesmallrisksto thebottom.Itisausualpracticetoanalyzeriskeitherbysensitivityanalysisorbyprobabilistic analysis.

Insensitivityanalysisastudyisdonetoanalysethechangesinthevariablevaluesbecauseofa changeinoneormoreofthedecisioncriteria. Intheprobabilityanalysis,thefrequencyofaparticulareventoccurringisdetermined,basedon whichitaverageweightedaveragevalueiscalculated. Eachoutcomeofaneventresultinginarisksituationinariskanalysisprocessisexpressedasa probability.Riskanalysiscanbeperformedbycalculatingtheexpectedvalueofeachalternative andselectingthebestalternative.

Ex : Now that the group has assigneda priority to each risk, it is ready to select the items to mange.Someprojectsselectasubsettotakeactionupon,whileotherschoosetoworkonallof

SikkimManipalUniversity

164

ProjectManagement

Unit11

theitems.Togetstarted,youmightselectthetop3risks,orthetop20%,basedonthepriority calculation.

SelfAssessmentQuestions2:Fillintheblanks
1. 2. Thefirststepinriskanalysisistomakeeachriskitemmore_____. In ________a study is done toanalyse the changes in thevariablevaluesbecause of a changeinoneormoreofthedecisioncriteria. 3. In the _________, the frequency of a particular event occurring is determined, based on whichitaverageweightedaveragevalueiscalculated.

11.4 RiskManagementPlanning
Therearetwothingsonecandotomanagerisk.Thefirstistotakeactiontoreduce(orpartially reduce) the likelihood of the risk occurring. For example, some project that work on process improvementmaketheirdeadlinesearlierandincreasestheireffortstominimizethelikelihoodof teammembersbeingpulledofftheprojectduetochangingorganizationalpriorities.Inasoftware product,acriticalfeaturemightbedevelopedfirstandtestedearly.

Second, we can take action to reduce the impact if the risk does occur. Sometimes this is an action taken prior to the crisis, such as the creation of a simulator to use for testing if the hardwareislate.Atothertimes,itisasimplebackupplan,suchasrunninganightshifttoshare hardware.

Forthepotentiallossofakeyperson,forexample,wemightdotwothings: Plantoreducetheimpactbymakingsureotherpeoplebecomefamiliarwiththatpersonswork, or reducethelikelihoodofattritionbygivingthepersonaraise,orbyprovidingdaycare.

SelfAssessmentQuestions3:TrueorFalse
1. 2. Inmanagingarisk,thefirstistotakeactiontoincreasethelikelihoodoftheriskoccurring. Inmanagingarisk,thesecondstepistotakeactiontoreducetheimpactiftheriskdoes occur.

SikkimManipalUniversity

165

ProjectManagement

Unit11

11.5 ReviewRisks
You wanttoreviewyourrisksperiodicallysoyoucancheckhow wellmitigationisprogressing. Youcanalsoseeiftheriskprioritiesneedtochange,orifnewriskshavebeendiscovered,you might decide to rerun the complete risk process if significant changes have occurred on the project.Significantchangesmightincludetheadditionofnewfeatures,thechangingofthetarget platform,orachangeinprojectteammembers.Manypeopleincorporateriskreviewintoother regularlyscheduledprojectreviews.

In summary, risk management is the planning to potential problems, and the management of actionstakenrelatedtothoseproblems.

11.6 RiskManagementProcess
Determinescopeoftherisksession.Selecttheteamandmoderator. Themoderatorexplainsthe riskprocesstonewteammembers.Identifyrisks(potentialfutureproblems).Brainstormareasof risk, e.g., Weak areas such as unknown technology. Things which are critical are extremely importanttothe effort. Such as thetimely delivery ofavendorsdatabasesoftware, creation of translators,orauserinterfacethatmeetsthecustomersneeds. Identifythingsthathavecaused problems in the past, such as loss of key staff, missed deadlines, or errorprone software. Removeinvalidorirrelevant.

Currentproblemsshouldbetreatedasproblems,notrisks.Minimizetherisks.Stakeholdersmay adoptvariousstrategiestopreventtheriskbutrisksareunavoidable.Risksvaryfromoneproject toanotherproject.Acontingencyplanhastobepreparedtohandletherisks. Themainstepstohandlerisksare: a) Identifyrisks Foreachriskitem: 1) Doestheteamunderstandtheriskitem?Ifnecessary,splitintoseparateriskitems,e.g., DiskmayoverloadunderconditionX.DiskmayoverloadunderconditionY.Discussand determineitsscope. 2) Whatwouldtheconsequencesbeifthisriskitemdidhappen? 3) Determinewhattheimpactwouldbeiftheworsthappened,usingascaleofonetoten. 4) Determinehowlikelyitisthattheriskitemwilloccur,usingascaleofonetoten. 5) Determinethepriorityoftheriskitemsandthuswhichtoworkon(impactxlikelihood).

SikkimManipalUniversity

166

ProjectManagement

Unit11

b)

AnalyzetheriskUseanyoftheavailablemethodstoanalyzetherisk.Softwaremaybe usedforthepurposeofanalysis.

c)

PlantomitigaterisksSelectthemostimportantriskissues,suchasthetop2or3,ortop 20%. Brainstorm on actions that could be taken to reduce the likelihood of the risk item occurring. Brainstorm onactions that could be taken to reduce the impact if the risk item does occur. Decide which actions to pursue. Select a person to be responsible for each actionchosen. Documenttheinformationintheriskmanagementplan.

d)

ReviewrisksEstablishhowoftenrisksshouldbereviewed(onceamonthistypical).Risk reviewscanbeincorporatedintoexistingprojectstatusandphasereviews.Updatethelist basedonriskreviewsessions.

e)

ControltheriskItreferstocontrollingthedeviationsinaprojectwhichmaybeoneofthe reasonstoinduceariskelementintheproject.Controllingtheriskensuresthattheproject islikelytobecompletedaspertheplansandheadingtowardsthegoalssetfortheproject. Itispreferabletoworkinastructuredmodetohandlerisksinaproject.

SelfAssessmentQuestions4:Fillintheblanks
1. ________involvesidentifyingpotentialproblems(risks),analyzingthoserisks,planningto managethem,andreviewingthem. 2. Riskidentificationcanbedoneusinga______session.

11.6 OverviewofRiskManagement
Thereismutualbenefitforcorporateand majorinformationsystemsprojectteamsandmanyof the programs as a result of the information exchange generated by the Project Management Reviews.

Corporate and major information systems are reviewed from their inception to retirement, i.e., throughout the Capital Planning and Investment Control (CPIC) phases of Identification, Selection,Control,andEvaluate.

SikkimManipalUniversity

167

ProjectManagement

Unit11

Severalofthecurrentandfuturecorporateandmajorinformationsystemsinitiativeshavebeen identified in the Departmental Information Architecture Program guidance series and in the CorporateSystemsInformationArchitecture(CSIA)document.

The templates serve as a means of standardizing the reporting requirements and enabling a commonsetofcriteriaforevaluatingthehealthandprogressoftheDepartmentscorporateand majorinformationsystems.Presentersmaychoosetodeveloptheirownsetofslidesaslongas therequestedinformationiscovered.

Performancemeasurementsareusedinprojectmanagementandqualityprocessestodetermine andcommunicatestatusandaccomplishmentsmeasuredagainstspecificobjectives,schedules, and milestones. These measurements extend to include delivery of desired products and services.

Therearetwothingsonecandotomanagerisk.Thefirstistotakeactiontoreduce(orpartially reduce) the likelihood of the risk occurring. For example, some projects that work on process improvementmaketheirdeadlinesearlierandincreasetheirefforts.Second,wecantakeaction toreducetheimpactiftheriskdoesoccur.Sometimesthisisanactiontakenpriortothecrisis, suchasthecreationofasimulatortousefortestingifthehardwareislate.

Youmightdecidetorerunthecompleteriskprocessifsignificantchangeshaveoccurredonthe project.Significantchangesmightincludetheadditionofnewfeatures,thechangingofthetarget platform,or a changein project team members.Manypeopleincorporate risk review intoother regularlyscheduleprojectreviews.

SelfAssessmentQuestions5:TrueorFalse
1. CSIAstandsforCollaborativeSystemsforInformationAnalysis. 2. Performance measurements are used in project management and quality processes to determineandcommunicatestatusandaccomplishmentsmeasuredagainstspecificobjectives, schedules,andmilestones.

SikkimManipalUniversity

168

ProjectManagement

Unit11

11.7 Summary
This unit has covered the fundamentals of reviewing a project and also identifying the risks involvedinaproject.Studentwouldhavelearntthevarioussituationsofriskandalsoidentifythe problemofrisk.Thisunithelpsinanalyzingtheriskandthestepsnecessarytomanagetherisks. Alsotheunithasfocusedontheprocessesneededtoreviewarisksituationandtheriskandits causes.Students,afterhavinggonethroughthisunitwouldhavelearnthowtomitigaterisk.

TerminalQuestions
1. 2. 3. Whatarethetypesofrisksinvolvedinaproject? Whatarethetypicalstepsinvolvedinanalyzingarisk? Explainthefivestepstohandlearisk.

AnswersToSelfAssessmentQuestions:
SELFASSESSMENTQUESTIONS1 1True 2False 3False

SELFASSESSMENTQUESTIONS2 1Specific 2SensitivityAnalysis 3ProbabilityAnalysis.

SELFASSESSMENTQUESTIONS3 1 False 2 True SELFASSESSMENTQUESTIONS4 1RiskManagement 2Brainstorming SELFASSESSMENTQUESTIONS5 1 False 2 True

SikkimManipalUniversity

169

ProjectManagement

Unit11

AnswerstoTerminalQuestions:
1. 2. 3. Refer11.2 Refer11.3 Refer11.6

SikkimManipalUniversity

170